
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
CLI tool that scaffolds opinionated SaaS projects with a fully functional walking skeleton
A CLI that scaffolds opinionated SaaS projects with a fully functional walking skeleton—a complete frontend, backend, and database stack with auth pre-integrated.
🚀 Available on npm - Install with npx r9stack@dev
| Feature | Status |
|---|---|
| TanStack Start + React 19 | ✅ Working |
| Starter-based architecture | ✅ Working |
| shadcn/ui + Tailwind CSS | ✅ Working |
| Convex backend | ✅ Working |
| WorkOS auth | ✅ Working |
| Flight Rules docs | ✅ Working |
| GitHub repo creation | ✅ Working |
| Vercel deployment | 📋 Planned |
| Stripe payments | 📋 Post-V1 |
Agentic coding has dramatically accelerated feature development, but initial project setup—configuring the frontend framework, wiring up the backend and database, integrating auth providers—remains tedious and error-prone.
r9stack eliminates this friction. Run a single command and have a scaffolded full-stack project in minutes.
r9stack uses TanStack Start's starter system to create projects:
--starter flag pointing to a hosted starter.json| Layer | Technology | Description |
|---|---|---|
| Framework | TanStack Start | Full-stack React framework with SSR and server functions |
| UI Library | React 19 | Declarative UI with the latest React features |
| Language | TypeScript | Type-safe JavaScript for reliable code |
| Styling | Tailwind CSS 4 | Utility-first CSS framework |
| Build | Vite | Lightning-fast build tool and dev server |
| Backend | Convex | Real-time backend with automatic sync |
| Auth | WorkOS AuthKit | Enterprise-ready SSO and MFA |
| Sessions | iron-session | Encrypted cookie-based sessions |
| Components | shadcn/ui | Beautiful, accessible Radix-based components |
# Create a new project
npx r9stack@dev init my-project
# Clone the repository
git clone https://github.com/ryanpacker/r9stack.git
cd r9stack
# Install dependencies and build
npm install
npm run build
# Link globally for testing
npm link
# Create a new project
r9stack init my-project
# Interactive mode - prompts for project name and options
npx r9stack@dev init
# Provide project name directly
npx r9stack@dev init my-awesome-app
# Non-interactive with defaults (installs Flight Rules, skips GitHub)
npx r9stack@dev init my-awesome-app --yes
# Create with GitHub repo
npx r9stack@dev init my-awesome-app --yes --github
# Create public GitHub repo
npx r9stack@dev init my-awesome-app --github --public
# Skip Flight Rules installation
npx r9stack@dev init my-awesome-app --no-flight-rules
# Use a specific starter
npx r9stack@dev init my-awesome-app --starter standard
# List available starters
npx r9stack@dev --starter-list
# View help
npx r9stack@dev init --help
| Flag | Description |
|---|---|
-y, --yes | Skip confirmation prompts |
-s, --starter <id> | Use a specific starter (e.g., 'standard') |
--no-flight-rules | Skip Flight Rules installation |
--github | Create GitHub repository |
--no-github | Skip GitHub repository creation |
--private | Make GitHub repository private (default) |
--public | Make GitHub repository public |
The CLI will:
Running npx r9stack@dev init will create a project with:
my-project/
├── .flight-rules/ # Flight Rules documentation framework
│ ├── AGENTS.md # Agent guidelines
│ ├── commands/ # Coding session workflows
│ └── doc-templates/ # Documentation templates
├── convex/
│ ├── _generated/ # Auto-generated by Convex
│ ├── schema.ts # Database schema
│ └── messages.ts # Demo Convex functions
├── public/
│ └── images/ # App logos and assets
├── src/
│ ├── components/
│ │ ├── ui/ # shadcn components
│ │ ├── AppShell.tsx # Application shell
│ │ ├── Sidebar.tsx # Collapsible sidebar
│ │ ├── NavGroup.tsx # Navigation group
│ │ ├── NavItem.tsx # Navigation item
│ │ └── UserMenu.tsx # Auth-aware user menu
│ ├── lib/
│ │ ├── auth.ts # Auth types
│ │ ├── auth-client.ts # Client-side auth context
│ │ ├── auth-server.ts # Server-side auth (iron-session)
│ │ └── utils.ts # Utilities (cn helper)
│ ├── routes/
│ │ ├── __root.tsx # Root layout with providers
│ │ ├── index.tsx # Public landing page
│ │ ├── auth/ # Auth flow routes
│ │ │ ├── sign-in.tsx
│ │ │ ├── callback.tsx
│ │ │ └── sign-out.tsx
│ │ └── app/ # Protected routes
│ │ ├── route.tsx # Auth guard + AppShell
│ │ ├── index.tsx # Authenticated home
│ │ └── demo/ # Demo pages
│ └── styles.css # Tailwind + shadcn styles
├── .env.example
├── components.json # shadcn configuration
├── package.json
├── tsconfig.json
└── vite.config.ts
/ — Public landing page/auth/* — Authentication flow (sign-in, callback, sign-out)/app/* — Protected routes (requires authentication)After scaffolding, you'll need to:
npx convex dev to create project and authenticate.env.example to .env.local and fill in credentialsr9stack/
├── src/ # CLI source code
├── starters/
│ └── standard/ # r9-starter-standard source
├── tests/
│ ├── e2e/ # End-to-end tests
│ └── output/ # Test output (gitignored)
├── docs/
│ ├── prd.md # Product requirements
│ ├── implementation/ # Implementation specs
│ └── ...
└── dist/ # Compiled CLI
Apache 2.0 - See LICENSE for details.
FAQs
CLI tool that scaffolds opinionated SaaS projects with a fully functional walking skeleton
We found that r9stack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.